CVE-2025-54506
Last modified
CVE-2025-54506 is a medium-severity vulnerability rated 4/10 on the CVSS scale. A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AMD | AMD EPYC™ 9005 Series Processors | All versions |
| AMD | AMD EPYC™ Embedded 9005 Series Processors | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2025-54506?
How severe is CVE-2025-54506?
How do I fix CVE-2025-54506?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54500An HTTP/2 implementation flaw allows a denial-of-service (Do…5.3
- CVE-2025-54501Improper access control on an internal debug interface could…5.9
- CVE-2025-54502Incorrect use of boot service in the AMD Platform Configurat…7.5
- CVE-2025-54503Improper handling of overlap between protected memory ranges…5.9
- CVE-2025-54504Insufficient Granularity of Access Control in AMD Secure Enc…5.9
- CVE-2025-54505A transient execution vulnerability within AMD CPUs may allo…2
- CVE-2025-54507Improper validation of consistency within input in AMD SEV (…5.9
- CVE-2025-54508Improper validation of Reverse Map Table (RMP) entries in th…4
- CVE-2025-54509Improper access control for register interface in the Input-…4
- CVE-2025-5451A stack-based buffer overflow in Ivanti Connect Secure befor…4.9
- CVE-2025-54510A missing lock verification in AMD Secure Processor (ASP) fi…5.9
- CVE-2025-54511Improper handling of insufficient privileges in the AMD Secu…5.3
Are you affected by CVE-2025-54506?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST